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Art Unit: 3623 

DETAILED ACTION 
Summary 

1 . Claims 1 -20 are pending in the application. The instant application deals with a 
system and method for providing risk management. More specifically, the invention 
deals with providing a means to store and report risk and abatement information dealing 
with a particular project. The application of a method and system to enable risk 
management tools that are used in project management enables a team-based 
approach to risk management through providing web-based tools. In this system, 
various risk management elements are identified and assessed to provide a thorough, 
proactive means to conduct risk management in a project context. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(a) the invention was known or used by others in this country, or patented or described in a printed 
publication in this or a foreign country, before the invention thereof by the applicant for a patent. 

3. Claims 1, 2, 9, 10 and 17 are rejected under 35 U.S.C. 102(a) as being 
anticipated by RiskTrak Software Product as disclosed in the following documents: 

"RiskTrak Project Risk Management Software", March 6, 2000, pp.1-2, 
web.archive.org/web/20000306225414/http://risktrak.com/, hereafter referred to as 
Reference U1. 
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"Features and Benefits of RiskTrak Risk Management Software", November 4, 
1999, pp. 1-2, web.archive.org/web/19991 1041 35754/http://risktrak.com/feature.htm, 
hereafter referred to as Reference V1. 

"RiskTrak Risk Management Software for DoD Program Management and 
Program Management and Earned Value", October 7, 2000, pp. 1-5, 
web.archive.org/web/20001 00702571 6/http://risktrak.com/dod. htm, hereafter referred to 
as Reference W1 . 

"RiskTrak is an Integrated Tool for the Management of Cost, Schedule & 
Technical Risk", November 21, 2000, pp. 1-5, 

web.archive.org/web/20001 121 221 300/http://risktrak.com/evms. htm, hereafter referred 
to as Reference X1. 

Regarding Claim 1, RiskTrak discloses: 

defining impact criteria for all risks of a project, 

Reference X1 page 2 paragraph 3 line 2-6, impact criteria for all and any project 
risk can be defined during project setup based on weight factors and probabilities 

identifying a plurality of risks associated with the project; 

Reference X1 page 2 paragraph 2 line 1-3, a plurality of risks can be identified 
and structured according to project planning methodology, e.g., WBS or other. 

storing, in a database, risk information on at least one risk of the 
plurality of risks, 
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Reference V1 page 1 paragraph 4 line 1 , all risk information can be stored in any 
ODBC-relational database. 

assessing at least one risk of the plurality of risks using the defined 
impact criteria; 

Reference W1 page 2 paragraph 6 line 1-2, RiskTrak provides for continuous risk 
assessment based on impact criteria defined above during project setup. 

preparing at least one abatement corresponding to at least one risk of 
the plurality of risks; 

Reference W1 page 2 paragraph 5 line 6, mitigation (i.e. abatement), is prepared 
for each program risk. 

storing, in the database, abatement information on the at least one 
abatement, 

Reference W1 page 2 paragraph 8 line 1-2, all project risk information, including 
abatement information is stored in the RiskTrak database. 

monitoring the plurality of risks associated with the project as the 
project is completed; 

Reference W1 page 2 paragraph 6 line 1-2, RiskTrak provides continuous 
monitoring of risks and the associated mitigation (i.e. abatement) plans during the life of 
the project. 

Reference W1 page 2 paragraph 8 line 1-2, RiskTrak can be used throughout the 
life of a program for risk management. 

updating the risk information and the abatement information in the 
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database as the project is completed; and 

Reference X1 page 2 paragraph 5, complete visibility to all program or project 
risks are provided throughout the life of the project. 

Reference V1 page 1 paragraph 2 line 1-2, Risk and Mitigation (i.e. abatement) 
information can be updated to the database in real time, 24 hours a day, during the 
entire length of the project, including as the project is completed. 

repeating the steps of monitoring the plurality of risks and updating 
the risk information and the abatement information in the database until 
each risk of the plurality of risks is indicated as finished. 

Reference V1 page 1 paragraph 2 line 1-2, Risk and Mitigation (i.e. abatement) 
information can be updated to the database continuously during the entire length of the 
project, from start to finish. 

Reference W1 page 2 paragraph 6 line 1-2, risks can be continuously assessed 
and monitored throughout the life of a project - this is a DoD requirement met by 
RiskTrak. 

Regarding Claim 2, RiskTrak discloses: 

automatically generating a report having risk information and abatement 
information from the database. 

Reference X1 page 3 paragraph 6 line 1-3, risk management and contingency 
plans are automatically generated from RiskTrak's database. 
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Reference V1 page 1 paragraph 5 line 1-4, project status reports are available 
with a single mouse click. These reports include risk and abatement information. 

Claims 9 and 10 recite similar limitations as those recited in Claims 1 and 2 and 
are therefore rejected under the same rationale. 

Regarding Claim 17, Risktrak discloses: 

adding an additional risk to the plurality of risks for the project; 

Reference X1 Page 4 paragraph 4 line 3, new risks can be entered immediately 
upon receipt of new information. 

Reference W1 Page 3 paragraph 4 line 1-2, an unlimited number of risks can be 
entered into the database. 

adding an additional abatement corresponding to at least one risk of 
the plurality of risks; 

Reference X1 page 2 paragraph 7 line 1-5, project mitigations (i.e. abatements) 
corresponding to project risks can be added to a project baseline through a drag and 
drop interface. 

removing a risk from the plurality of risks for the project; and 

Reference X1 page 4 paragraph 5 line 1-3, changes to risks for the project are 
updated in real time. This includes removing a risk due to changes in risk where the 
risk is eliminated, either due to other external changes or the effects of a mitigation (i.e. 
abatement) plan. 
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removing an abatement corresponding to at least one risk of the 
plurality of risks. 

Reference X1 page 4 paragraph 5 line 1-3, changes to mitigation (i.e. abatement) 
for the project are updated in real time. This includes removing a mitigation due to it 
being effective in eliminating a risk. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 3-8, 11-16 and 18-20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over RiskTrak in view of Link. 

Link, Jo Lee Loveland; Barbour, Rick; Krum, Al; Neitzel, August; 
Rollout and Installation of Risk Management at the IMINT Directorate, National 
Reconnaissance", December 1999, Technical Report CMU/SEI-99-TR-009, ESC-TR- 
99-009. pp. 1-191 . http://www.sei.cmu.edu/pub/documents/99.reports/pdf/99tr009.pdf. 

Regarding Claim 3, RiskTrak teaches all the limitations of Claim 2 above, and 
also teaches: 

providing additional risk information and abatement information from the 
database. 



Application/Control Number: 09/886,362 Page 8 

Art Unit: 3623 

Reference X1 page 3 paragraph 6 line 1-3, risk management and contingency 
plans (i.e. contingency plans are abatement information) are provided from RiskTrak's 
database 

RiskTrak does not teach: 

wherein the report is a waterfall chart and the step of monitoring the 
plurality of risks further comprises a step of providing additional risk information 
and abatement information from the database in response to a selection of a 
point on the waterfall chart. 

Link teaches: 

wherein the report is a waterfall chart and the step of monitoring the 
plurality of risks further comprises a step of providing additional risk information 
and abatement information in response to a selection of a point on the waterfall 
chart. 

Page 185, this is a waterfall chart used to monitor risk mitigation (i.e. abatement) 
monitoring 

Page 184 line 7, links are provided to return users to related areas; these links 
would include the selection of a point on the waterfall chart. Related areas would 
provide additional risk and abatement information because the waterfall chart is a graph 
of project management plans to abate and mitigate risks in the future. 
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Link teaches the use of the waterfall chart promotes efficiency in project reviews 
and in developing a broad system understanding (Page 66 paragraph 5.2.3.4 line 1-4). 
This is an important consideration when applying risk management to complex projects 
where the plethora of reporting detail makes it difficult to understand the larger 
implications of what is occurring in the project. 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies, to include providing a waterfall chart and additional risk and 
abatement information in response to a selection of a point on the waterfall chart, as 
taught by Link, because it would improve the efficiency in conducting a risk 
management review, as taught by Link. 

Regarding Claim 4, RiskTrak teaches all the limitations of Claim 1 above, but 
does not teach 

wherein the step of defining impact criteria further comprises a step of 
defining impact criteria for at least one issue selected from the group consisting 
of technical issues, scheduling issues and cost issues. 
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Link teaches: 

wherein the step of defining impact criteria further comprises a step of 
defining impact criteria for at least one issue selected from the group consisting 
of technical issues, scheduling issues and cost issues. 

Page 66 Table 4 defines impact criteria for a system level risk consisting of 
technical issues (e.g. control of vehicle), scheduling and cost issues. The impact 
criteria are defined in terms of low, medium f and high probabilities. 

Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies, to include defining impact criteria for technical, cost and 
scheduling issues, as taught by Link, because it would provide significant cost savings 
during development and ensure technical reliability, as taught by Link. 
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Regarding Claim 5, RiskTrak teaches all the limitations of Claim 1 above and 
teaches: 

Assigning of weight factors and probabilities in analyzing and managing risk 
(Reference X1 page 2 paragraph 3 line 1-6). 

RiskTrak does not teach: 

providing a probability determination for at least one risk; 
providing a technical impact determination for at least one risk; 
providing a cost impact determination for at least one risk; and 
providing a schedule impact determination for at least one risk. 

Link teaches: 

providing a probability determination for at least one risk; 

Page 66 Table 4, probability determinations are provided in row 2 "Probability of 
Occurrence" for the risk outlined in this table. 

providing a technical impact determination for at least one risk; 

Page 66 Table 4, a technical impact determination is provided across various 
probability categories, e.g. ranging from lack of vehicle control to total vehicle control. 

providing a cost impact determination for at least one risk; and 

Page 66 Table 4, a cost impact is provided, e.g. ranging from >$5 million at a 
high risk probability to <$1 million for a low probability. 

providing a schedule impact determination for at least one risk. 
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Page 66 Table 4, a schedule impact determination is provided that measures the 
schedule impacts at high, medium and low risk. 

Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies, to include providing a probability determination and a 
technical, cost and schedule impact determination, as taught by Link, because it would 
provide significant cost savings during development and ensure technical reliability, as 
taught by Link. 

Regarding Claim 6, RiskTrak teaches all the limitations of Claim 1 above but 
does not teach: 

providing an estimated probability determination of the at least one 
abatement corresponding to at least one risk; 

providing an estimated technical impact determination of the at least 
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one abatement corresponding to at least one risk; 

providing an estimated cost impact determination of the at least one 
abatement corresponding to at least one risk; and 

providing an estimated schedule impact determination of the at least 
one abatement corresponding to at least one risk. 

Link teaches that program and project risks can be attributed into technical, cost, 
schedule and probability factors (Page 66 Table 4). 

Link also teaches: 

providing an estimated probability determination of the at least one 
abatement corresponding to at least one risk; 

Page 66 Table 4 shows that risks are categorized in terms of probabilities, as 
does Page 138 Figure 3, which shows how various risks are anticipated to move in the 
probability/impact continuum. 

Page 67 paragraph 5.2.3.7. "Waterfall Chart" provides an estimated probability 
determination of a mitigation strategy (i.e. abatement) corresponding to at least one risk. 
The waterfall chart tracks and forecasts the impact an abatement will have on risk. 

providing an estimated technical impact determination of the at least 
one abatement corresponding to at least one risk; 

Page 67 paragraph 5.2.3.7. "Waterfall Chart" provides an estimated probability 
determination of a mitigation strategy (i.e. abatement) corresponding to at least one risk, 
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including technical impacts. The waterfall chart tracks and forecasts the impact an 
abatement will have on risk, including technical risks. 

providing an estimated cost impact determination of the at least one 
abatement corresponding to at least one risk; and 

Page 67 paragraph 5.2.3.7. "Waterfall Chart" provides an estimated probability 
determination of a mitigation strategy (i.e. abatement) corresponding to at least one risk, 
including cost impacts. The waterfall chart tracks and forecasts the impact an 
abatement will have on risk, including cost risks. 

providing an estimated schedule impact determination of the at least 
one abatement corresponding to at least one risk. 

Page 67 paragraph 5.2.3.7. "Waterfall Chart" provides an estimated probability 
determination of a mitigation strategy (i.e. abatement) corresponding to at least one risk, 
including schedule impacts. The waterfall chart tracks and forecasts the impact an 
abatement will have on risk, including schedule risks. 

Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies, to include providing abatement effects upon probability, 
technical, cost and schedule risks, as taught by Link, because it would provide 
significant cost savings during development and ensure technical reliability, as taught by 
Link. 

Regarding Claim 7, RiskTrak teaches all the limitations of Claim 1 above but 
does not teach: 

providing an actual probability determination of the at least one 
abatement corresponding to at least one risk based on actual performance 
of the at least one abatement; 

providing an actual technical impact determination of the at least one 
abatement corresponding to at least one risk based on actual performance 
of the at least one abatement; 

providing an actual cost impact determination of the at least one 
abatement corresponding to at least one risk based on actual performance 
of the at least one abatement; and 

providing an actual schedule issue impact determination of the at least 
one abatement corresponding to at least one risk based on actual 
performance of the at least one abatement. 
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Link teaches: 

providing an actual probability determination of the at least one 
abatement corresponding to at least one risk based on actual performance 
of the at least one abatement; 

Page 67 paragraph 5.2.3.7, waterfall charts provide a probability determination of 
an abatement corresponding to at least one risk based on the performance of the 
abatement. The waterfall charts track progress of a mitigation plan to see how they are 
effective or not in reducing a particular risk item. 

Page 185 illustrates a waterfall chart and how the mitigation (i.e.. abatement) 
program reduced the project risk 

providing an actual technical impact determination of the at least one 
abatement corresponding to at least one risk based on actual performance 
of the at least one abatement; 

Page 67 paragraph 5.2.3.7, the waterfall chart is used to describe progress in 
reducing risk exposure (both in terms of impact and probability) from a mitigation (i.e. 
abatement) standpoint. Link teaches that program risks have three components, one of 
which is technical risk - see page 66 Table 4. 

providing an actual cost impact determination of the at least one 
abatement corresponding to at least one risk based on actual performance 
of the at least one abatement; and 

Page 67 paragraph 5.2.3.7, the waterfall chart is used to describe progress in 
reducing risk exposure (both in terms of impact and probability) from a mitigation (i.e. 



Application/Control Number: 09/886,362 Page 17 

Art Unit: 3623 

abatement) standpoint. Link teaches that program risks have three components, one of 
which is cost risk- see page 66 Table 4.. 

providing an actual schedule issue impact determination of the at least 
one abatement corresponding to at least one risk based on actual 
performance of the at least one abatement. 

Page 67 paragraph 5.2.3.7, the waterfall chart is used to describe progress in 
reducing risk exposure (both in terms of impact and probability) from a mitigation (i.e. 
abatement) standpoint. Link teaches that program risks have three components, one of 
which is schedule risk- see page 66 Table 4. 

Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies, to include providing abatement effects upon probability, 
technical, cost and schedule risks, based upon abatement performance, as taught by 
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Link, because it would provide significant cost savings during development and ensure 
technical reliability, as taught by Link. 

Regarding Claim 8, RiskTrak teaches all the limitations of Claim 1 above and 
teaches: 

Reference V1 page 1 paragraph 8, users utilize a database to store risk 
information. 

Reference W1 page 2 paragraph 5 line 3, uses an SQL engine to query 
application, thus RiskTrak utilizes a database since SQL is a database query language. 

RiskTrak does not teach 

displaying risk information from the database in a table; and displaying 
abatement information from the database in a table. 

Link teaches: 

displaying risk information from the database in a table; and displaying 
abatement information from the database in a table. 

Page 66 Table 4, displays risk information into a table so that users can see the 
various categories, probabilities and impacts of project risks. 

Page 187, the Risk Stoplight Chart displays abatement information in a table 

form. 
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Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies and storing risk information in a database, to include providing 
risk and abatement information in a table, as taught by Link, because it would provide 
significant cost savings during development and ensure technical reliability, as taught by 
Link. 

Claims 11-16 recite similar limitations as those recited in Claims 3-8 and are 
therefore rejected under the same rationale. 

Regarding Claim 18, RiskTrak teaches all the limitations in Claims 1 and 2 above 
except for: 

a server computer, said server computer comprising a storage device 
and a processor, 
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Reference V1 page 1 paragraph 1 , RiskTrak runs on any type of network and 
software/hardware combination. This would include running on a network server where 
the server comprises a storage device and processor. 

a risk management application to analyze and manage risks associated 
with a project, 

Reference V1 page 1 paragraph 1 line 2-3, Risktrak provides an organization the 
capability to analyze and manage risks through communication and reporting. 

said risk management application being stored in said storage device of 
said server computer, said risk management application further comprising: 

Reference V1 page 1 paragraph 1, Since RiskTrak runs on any 
hardware/software combination, this would include being stored in a storage device of a 
server computer running the software on a network. 

a database, said database storing information relating to said 
project, 

Reference X1 page 1 paragraph 4 line 1-6, RiskTrak stores information related to • 
said project (in this case Earned Value information) in a relational database. 

RiskTrak does not teach: 

means for calculating a risk score for said assessed at least one risk, said 
risk score being based on said assessment; 
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Official Notice is taken that the concept of providing a risk score for a project 
based on an assessment of that risk is old and well known in the art. An example of this 
type of methodology is the FMEA technique pioneered in the Apollo Program in the late 
1960's. FMEA (Failure Mode Effect Analysis) is a scoring method based on the 
assessment of a risk's severity (how bad would a failure be?), frequency (how likely is 
the failure to happen), and detectability (how easily would we know a failure occurred?). 

Each risk is assessed a score in these three categories based on a team's 
assessment for that particular risk. The three scores are multiplied together to come up 
with a Risk Priority Number (RPN). The RPN gives the team a quantitative measure of 
the risk to help prioritize it in comparison to other risks. So scoring the risk in such a 
manner as FMEA gives a project team a baseline in which to compare risks and decide 
which risk deserves greater attention. Risks are prioritized in order from greatest Risk 
Priority Number to the least. FMEA proved to be an effective way to focus on risks that 
provided the greatest threat to the Apollo mission. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing a network based risk 
management software program, to include where that program provides a means for 
scoring risks based on assessment of those risks, as is known in the art, because it 
would provide a way for a project team to prioritize risks in order to eliminate the most 
potentially damaging risks to the project. 
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Regarding Claim 19, RiskTrak teaches all the limitations of Claim 18 above and 
also teaches: 

means for creating a new project, said means for creating a new project 
comprising means for providing project information, said project information 
being stored in said database, 

Reference X1 page 2 paragraph 3 line 3-6, the project setup feature allows a 
new project to be created and project information to be entered. 

Reference X1 page 1 paragraph 4 line 1-6, RiskTrak stores information related to 
projects in a relational database. 

means for selecting a project from a plurality of projects; 

Reference X1 page 3 paragraph 5 line 1-3. a project can be selected from a 
group of multiple projects for the purpose of providing reports. 

Reference X1 page 4 paragraph 2 line 2, a project can be selected for the 
purpose of comparing it to other projects. 

means for updating said project information stored in said database; 

Reference X1 page 4 paragraph 4 line 3, new risk information can be updated 
into project information. 

Reference X1 page 1 paragraph 4 line 4, RiskTrak uses a relational database to 
store project and risk information. 
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RiskTrak teaches using a database to store risk and project information and 
using SQL to query the database to obtain risk and project information (Reference V1 
page 1 paragraph 5 line 1-3). 

RiskTrak does not teach: 

means for displaying a risk summary table, said risk summary table 
including risk information from said database; and 

means for displaying an abatement summary table, said abatement 
summary table including abatement information from said database. 

Link teaches: 

means for displaying a risk summary table, said risk summary table 
including risk information from said database; and 

Page 189, the risk summary sheet displays a risk summary table that contains 
risk information. 

means for displaying an abatement summary table, said abatement 
summary table including abatement information from said database 

Page 187, the risk stoplight chart contains abatement summary information in a 
table format. 
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Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies and storing risk information in a database, to include providing 
a risk summary table and abatement summary table, as taught by Link, because it 
would provide significant cost savings during development and ensure technical 
reliability, as taught by Link. 

Regarding Claim 20, RiskTrak teaches all the limitations of Claim 18 above and 
also teaches: 

at least one client computer is in communication with said server 
computer over an intranet; 

Reference V1 page 1 paragraph 1 , RiskTrak runs on any type of network and 
software/hardware combination. This would include where at least one client computer 
is in communication with a server computer over an Intranet. 
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said means for updating further comprises: means for adding risk 
information to said database on an additional risk to said plurality of risks; 

Reference X1 Page 4 paragraph 4 line 3, new risks can be entered immediately 
upon receipt of new information. 

Reference W1 Page 3 paragraph 4 line 1-2, an unlimited number of risks can be 
entered into the database 

means for adding abatement information to said database on an additional 
abatement corresponding to at least one risk of said plurality of risks; 

Reference X1 page 2 paragraph 7 line 1-5, project mitigations (i.e. abatements) 
corresponding to project risks can be added to a project baseline through a drag and 
drop interface 

means for editing risk information in said database on a risk of 
said plurality of risks, 

Reference V1 page 1 paragraph 2 line 1-3, risk information can be updated, 
which would include editing the risk information in RiskTrak's database. 

means for editing abatement information in said database on an abatement 
corresponding to at least one risk of said plurality of risks; 

Reference X1 page 4 paragraph 8 line 1-2, changes, including abatement 
information can be made throughout the life of a project. 

means for removing risk information from said database on a 
risk of said plurality of risks; and 
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Reference X1 page 4 paragraph 5 line 1-3, changes to risks for the project are 
updated in real time. This includes removing a risk information due to changes in risk 
where the risk is eliminated, either due to other external changes or the effects of a 
mitigation (i.e. abatement) plan 

means for removing abatement information from said database on an 
abatement corresponding to at least one risk of said plurality of risks. 

Reference X1 page 4 paragraph 5 line 1-3, changes to mitigation (i.e. abatement) 
for the project are updated in real time. This includes removing mitigation information 
as the mitigation over the course of a project. 

RiskTrak also teaches a Microsoft Windows™ based application (Reference V1 
page 2 paragraph 4 line 1-3) that uses a database. 

RiskTrak does not teach: 

said risk management application is configured for execution in a web 
browser. 

Official Notice is taken that it is old and well known in the art of web-based 
applications to provide a web browser for interaction with a database. The use of a thin 
client (i.e. browser) to provide functionality over an intranet or internet allows for the 
flexibility provided by distributed computing. 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak. regarding providing risk management 
tools and methodologies and storing risk information in a database, to include providing 
a web browser to access a risk management application on a server, because it would 
provide the flexibility of distributed computing to allow a wide variety of users to easily 
access the risk management application over network. 

RiskTrak does not teach: 

said risk impact criteria comprises at least one criteria selected from 
the group consisting of technical impact criteria, schedule impact criteria 
and cost impact criteria; 

said means for providing an assessment comprises means for providing an 
impact assessment for said risk impact criteria, said impact assessment 
including a high impact assessment, a medium impact assessment and a low 
impact assessment, and 

Link teaches: 

said risk impact criteria comprises at least one criteria selected from 
the group consisting of technical impact criteria, schedule impact criteria 
and cost impact criteria; 
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Page 66 Table 4 defines risk impact criteria for a system level risk consisting of 
technical issues (e.g. control of vehicle), scheduling and cost issues. The impact 
criteria are defined in terms of low, medium and high probabilities. 

said means for providing an assessment comprises means for providing an 
impact assessment for said risk impact criteria, said impact assessment 
including a high impact assessment, a medium impact assessment and a low 
impact assessment, 

Page 66 Table 4 defines impact criteria for a system level risk consisting of 
technical issues (e.g. control of vehicle), scheduling and cost issues. The impact 
criteria are defined in terms of low, medium and high assessments. 

Link teaches that their approach for risk management would result in significant 
savings and technical reliability for mission-critical systems (Page 12 paragraph 2.3 line 
1-4). 

RiskTrak and Link are analogous art because both deal with the application of 
tools and methodologies to provide risk management. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the teachings of RiskTrak, regarding providing risk management 
tools and methodologies, to include defining risk impact criteria and providing 
assessments for the risk impact criteria, as taught by Link, because it would provide 
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significant cost savings during development and ensure technical reliability, as taught by 
Link. 

Conclusion 

6. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

US 2004/0199445 by Eder discloses a business activity management system for 
identifying and measuring value and risk associated with a business enterprise. 

US 2002/0059093 by Barton discloses a system and method for identifying and 
quantifying risks associated with compliance programs. 

US 2001/0027389 by Beverina discloses an integrated risk management tool for 
assessing risk in various real world applications. 

"RiskTrak™ - MIS Program Case Study", copyright 1997, Risk Services & 
Technology, pp. 1-9. 

Steen, Margaret, "Avoiding the Pitfalls of Risk", Dec 1997, InfoWorld, v19n51/52, 
pp.75-76. 

Dorn, Mark, "Vendors sell peanuts partners sell solutions", Oct 1998, Risk 
Management, v45n10, pp. 14-16. 

Williams, Ray C; Pandelios, George J.; Behrens, Sandra G; "Software Risk 
Evaluation (SRE) Method Description (Version 2.0)", Dec 1999, Technical Report, 
Carnegie Mellon University / Software Engineering Institute, CMU/SEI-99-TR-029. pp.1- 
101. 
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Browning, Tyson; Deyst, John J; Eppinger, Steven D; Whitney, Daniel; "Complex 
System Product Development: Adding Value by Creating Information and Reducing 
Risk", December 1999, The Lean Aerospace Initiative, Center for Technology, Policy 
and Industrial Development, MIT, pp.1-9. 

Browning, Tyson; "Sources of Schedule Risk in Complex System Development", 
July 1998, Proceedings of the Eight Annual International Symposium of INCOSE, pp.1- 
8. 

Wiegers, Karl; "Know Your Enemy: Software Risk Management", October 1998, 
Software Development, pp. 1-8, www.processimpact.com/articles/risk_mgmt.html. 

"Chapter 6 - Risk Management", May 2000, GSAM, pp. 1-47, 
http://www.stsc.hill.af.mil/resources/tech_docs/gsam3/chap6.pdf. 

"Risk Newsletter", 3 rd Quarter 1999, Society for Risk Analysis, pp. 1-1 6. 

"Futron Products and Services: Risk-based Decision Support", 2000, 
web.archive.org archive offutron.com, pp.1 -5. 

Mueller, Dr Andreas; "Integrated Risk Management - A holistic Risk 
Management Approach for the Insurance Industry", 1999, pp.1-15. 

Jaycock, MA; Reinert, K H; Scribner, H E; Boyce, S D; "Total Quality 
Management of the product risk assessment process", Nov 1997, American Industrial 
Hygiene Association Journal, v58n11, pp.814-819, Dialog 01541642 01-92630. 

Barki, Henri; Rivard, Suzanne; Talbot, Jean; "Toward an assessment of software 
development risk", Fall 1993, Journal of Management Information Systems, v10n2, 
pp.203-225. Dialog 00813256 94-62648. 
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Department of Defense Regulation, Number 5000. 2-R, March 15, 1996, Subject: 
Mandatory Procedures for Major Defense Acquisition Programs (MDAPs) and Major 
Automated Information System (MAIS) Acquisition Programs, parts 1-6, appendices I- 
VI. 



7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jonathan G. Sterrett whose telephone number is 703- 
305-0550. The examiner can normally be reached on 8-6. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tariq Hafiz can be reached on 703-305-9643. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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